chore: use spawn arg arrays, remove dead code, fix template var

[adamreynolds-io]

Summary

• Standardize child process calls: git-cloner and package-manager now use spawnSync with argument arrays, matching the pattern already used by git-utils and package-installer. This avoids shell string interpolation and is easier to read/maintain.
• Compact installer: downloads the installer script to a temp file before executing, instead of piping curl output directly to sh. Includes a shebang check to reject non-script responses (e.g. HTML error pages).
• Path safety guard: create-app now rejects dangerous project paths (/, ~, system dirs) before any fs.remove call.
• Remove dead code: ErrorHandler.checkDocker, ErrorHandler.checkNodeVersion, ErrorHandler.warn, ErrorHandler.info, and PackageInstaller.detectPackageManager all had zero callers.
• Remove redundant Node check from cli.ts — the bin entry point already enforces Node >= 22 via semver.satisfies before cli.ts runs.
• Fix {{author}} template variable: was never provided to Mustache, rendered as empty string silently. Now explicitly "".
• Exclude test.ts from build: smoke test no longer compiles to dist/test.js and ships in the npm package.

Test plan

• tsc --noEmit passes
• vitest run — all 39 tests pass
• Manual: npx create-mn-app test-app --template hello-world --skip-install --skip-git still scaffolds correctly
• Manual: npx create-mn-app test-app --from midnightntwrk/example-counter --dry-run shows expected output

Generated with Claude Code